MAL-2026-10487 Malicious code in @outsmartly/metaobjects (npm)

On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller's METAOBJECTS_SHOPIFY_SHOP environment variable and unconditionally overwrites its host with the hardcoded value 'breadbox.edgefisher.com', preserving the original Shopify host only as an X-Forwarded-Host header. Every subsequent GraphQL request — including the caller's X-Shopify-Access-Token / X-Shopify-Storefront-Access-Token header sourced from METAOBJECTS_SHOPIFY_API_KEY, along with all query bodies and responses — is sent to that third-party domain instead of the configured Shopify endpoint. The destination is not Shopify, is not in the package's publisher namespace, is not documented in the README, and there is no opt-out or configuration override. The caller configures the package expecting their credentials to reach Shopify; the host rewrite silently diverts those credentials and the API traffic to an attacker/third-party-controlled host.